The vulnerability allows an authenticated user with Subscriber or higher privileges to insert and execute arbitrary WordPress shortcodes. The flaw arises because the plugin does not validate the shortcode value before passing it to do_shortcode, enabling the user to supply malicious code in the shortcode. Executing such a shortcode can lead to code execution, data exfiltration, or other malicious actions, as WordPress shortcodes can invoke a wide range of functions within the site.

All installed versions of marketingfire’s Discussion Board – WordPress Forum Plugin up to and including 2.5.5 are affected. The plugin should be upgraded to any release newer than 2.5.5 to mitigate the issue.

The CVSS score of 6.3 reflects a moderate severity, while the EPSS score of less than 1% indicates a low probability of exploitation in the wild at the time of analysis. The flaw is not listed in the CISA KEV catalog. The likely attack vector is an authenticated user who has Subscriber-level access or higher; the attacker would log in with valid credentials or compromise an account to leverage the plugin’s shortcode execution feature. No public exploit is actively reported, but the consequence of successful exploitation includes full code execution on the affected WordPress site.